This vulnerability (CVE-2026-53408) in Zoom Workplace arises from improper authorization in the handler for a custom URL scheme. Specifically, versions prior to 7.0.4 on Android and 7.0.3 on iOS do not adequately verify authorization, enabling an unauthenticated attacker with network access to escalate privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and high impact on confidentiality and integrity. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker with network access could exploit this vulnerability to escalate privileges within Zoom Workplace, potentially gaining unauthorized access to sensitive information or performing actions with elevated rights. The confidentiality and integrity of data handled by the application are at high risk. Availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when handling custom URL schemes and restrict network access where possible. Monitor official Zoom Communications advisories for updates on patches or mitigations.